Strategy11Team
Monthly
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.
SQL injection in AWP Classifieds plugin for WordPress versions up to 4.4.5 allows remote unauthenticated attackers to extract sensitive database contents via array key manipulation in the 'regions' parameter. The vulnerability stems from insufficient escaping of user input in search functionality, affecting the plugin's query integration and page search components. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and no authentication required, this poses significant risk to WordPress sites running this classifieds plugin, though no public exploit or active exploitation has been identified at time of analysis.
High severity vulnerability in Formidable Forms (WordPress plugin). The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `ve...
The Formidable Forms WordPress plugin versions up to 6.28 contain an authorization bypass vulnerability in the Stripe payment integration that allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion. An attacker can exploit the publicly exposed nonce in the `frm_strp_amount` AJAX handler to overwrite POST data and recalculate dynamic pricing fields, enabling payment of reduced amounts for goods or services. While the CVSS score is moderate at 5.3, the vulnerability has direct financial impact on e-commerce deployments and poses a meaningful risk to sites using dynamic pricing with Formidable Forms and Stripe.
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.
SQL injection in AWP Classifieds plugin for WordPress versions up to 4.4.5 allows remote unauthenticated attackers to extract sensitive database contents via array key manipulation in the 'regions' parameter. The vulnerability stems from insufficient escaping of user input in search functionality, affecting the plugin's query integration and page search components. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and no authentication required, this poses significant risk to WordPress sites running this classifieds plugin, though no public exploit or active exploitation has been identified at time of analysis.
High severity vulnerability in Formidable Forms (WordPress plugin). The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `ve...
The Formidable Forms WordPress plugin versions up to 6.28 contain an authorization bypass vulnerability in the Stripe payment integration that allows unauthenticated attackers to manipulate PaymentIntent amounts before payment completion. An attacker can exploit the publicly exposed nonce in the `frm_strp_amount` AJAX handler to overwrite POST data and recalculate dynamic pricing fields, enabling payment of reduced amounts for goods or services. While the CVSS score is moderate at 5.3, the vulnerability has direct financial impact on e-commerce deployments and poses a meaningful risk to sites using dynamic pricing with Formidable Forms and Stripe.